emdash 1.2.0 → 1.3.0

package/src/astro/middleware/redirect.ts

@@ -21,6 +21,7 @@ import { after } from "../../after.js";
 import { RedirectRepository } from "../../database/repositories/redirect.js";
 import { getDb } from "../../loader.js";
 import { createRedirectSource } from "../../redirects/artifacts.js";
+import type { CachedRedirects, RedirectRule } from "../../redirects/cache.js";
 import { loadCachedRedirects, matchCachedPatterns } from "../../redirects/cache.js";
 import { isSiteRelativeDestination } from "../../redirects/destination.js";
 import { isTerminalStatus } from "../../redirects/status.js";
@@ -53,6 +54,50 @@ function recordHitInBackground(repo: RedirectRepository, id: string): void {
 	});
 }
 
+interface RedirectMatch {
+	redirect: RedirectRule;
+	destination: string;
+}
+
+/** Exact rules first, with or without a trailing slash, then patterns in precedence order. */
+function matchRedirect(cached: CachedRedirects, pathname: string): RedirectMatch | null {
+	let exact = cached.exact.get(pathname);
+	if (!exact && pathname.length > 1) {
+		const alt = pathname.endsWith("/") ? pathname.slice(0, -1) : `${pathname}/`;
+		exact = cached.exact.get(alt);
+	}
+	if (exact) return { redirect: exact, destination: exact.destination };
+	return matchCachedPatterns(cached.patterns, pathname);
+}
+
+/** The response for a matched rule, or null when its destination is not safe to send. */
+function redirectResponse(
+	context: APIContext,
+	repo: RedirectRepository,
+	{ redirect, destination }: RedirectMatch,
+): Response | null {
+	// Terminal statuses (410 Gone / 451): serve the status directly,
+	// with no Location header.
+	if (isTerminalStatus(redirect.type)) {
+		recordHitInBackground(repo, redirect.id);
+		return new Response(null, { status: redirect.type });
+	}
+	if (!isSiteRelativeDestination(destination)) {
+		warnUnsafeDestination(redirect.id);
+		return null;
+	}
+	recordHitInBackground(repo, redirect.id);
+	const code = isRedirectCode(redirect.type) ? redirect.type : 301;
+	return context.redirect(destination, code);
+}
+
+/** Whether Astro's route cache will store the response: it does once a max age or a tag is set. */
+function routeCacheStores(cache: APIContext["cache"] | undefined): boolean {
+	if (!cache?.enabled) return false;
+	const { maxAge, tags } = cache.options;
+	return maxAge !== undefined || (tags?.length ?? 0) > 0;
+}
+
 export const onRequest = defineMiddleware(async (context, next) => {
 	const { pathname } = context.url;
 
@@ -80,52 +125,23 @@ export const onRequest = defineMiddleware(async (context, next) => {
 
 	try {
 		const repo = new RedirectRepository(db);
+		const source = createRedirectSource(db);
+		const routeCache: APIContext["cache"] | undefined = context.cache;
 
 		// One query loads the published rules into the cache; warm requests
 		// issue zero queries, and an expired cache checks the published version
 		// in the background. Empty-redirect sites cache an empty Map + array.
-		const cached = await loadCachedRedirects(createRedirectSource(db));
-
-		// 1. Exact match (O(1) Map lookup)
-		let exact = cached.exact.get(pathname);
-		if (!exact && pathname.length > 1) {
-			const alt = pathname.endsWith("/") ? pathname.slice(0, -1) : `${pathname}/`;
-			exact = cached.exact.get(alt);
-		}
-		if (exact) {
-			// Terminal statuses (410 Gone / 451): serve the status directly,
-			// with no Location header.
-			if (isTerminalStatus(exact.type)) {
-				recordHitInBackground(repo, exact.id);
-				return new Response(null, { status: exact.type });
-			}
-			const dest = exact.destination;
-			if (!isSiteRelativeDestination(dest)) {
-				warnUnsafeDestination(exact.id);
-				return next();
-			}
-			recordHitInBackground(repo, exact.id);
-			const code = isRedirectCode(exact.type) ? exact.type : 301;
-			return context.redirect(dest, code);
-		}
-
-		// 2. Pattern match (compile once, match every request)
-		const patternMatch = matchCachedPatterns(cached.patterns, pathname);
-		if (patternMatch) {
-			const { redirect, destination } = patternMatch;
-			// Terminal statuses (410 Gone / 451): serve the status directly.
-			if (isTerminalStatus(redirect.type)) {
-				recordHitInBackground(repo, redirect.id);
-				return new Response(null, { status: redirect.type });
-			}
-			if (!isSiteRelativeDestination(destination)) {
-				warnUnsafeDestination(redirect.id);
-				return next();
-			}
-			recordHitInBackground(repo, redirect.id);
-			const code = isRedirectCode(redirect.type) ? redirect.type : 301;
-			return context.redirect(destination, code);
+		// A response the route cache stores is served to every visitor until it
+		// is purged, so before one is returned the rules are verified current.
+		let cached = await loadCachedRedirects(source);
+		let match = matchRedirect(cached, pathname);
+		let verified = false;
+		if (match && routeCacheStores(routeCache)) {
+			cached = await loadCachedRedirects(source, { verify: true });
+			verified = true;
+			match = matchRedirect(cached, pathname);
 		}
+		if (match) return redirectResponse(context, repo, match) ?? next();
 
 		// No redirect matched -- proceed and check for 404
 		const response = await next();
@@ -135,10 +151,23 @@ export const onRequest = defineMiddleware(async (context, next) => {
 		// the fix. Astro has no cache handle for URLs that match no route, but a
 		// page answering a content miss with Astro.rewrite("/404") has one.
 		if (response.status === 404) {
-			const routeCache: APIContext["cache"] | undefined = context.cache;
 			routeCache?.set(false);
 		}
 
+		if (!verified && routeCacheStores(routeCache)) {
+			const current = await loadCachedRedirects(source, { verify: true }).catch(() => cached);
+			const late = current === cached ? null : matchRedirect(current, pathname);
+			const redirected = late && redirectResponse(context, repo, late);
+			if (redirected) {
+				routeCache?.set(false);
+				// Finish the discarded render instead of cancelling it: a render cut off
+				// with its request never settles an isolate-wide fetch it started, and
+				// every later render awaiting that fetch hangs.
+				after(() => response.body?.pipeTo(new WritableStream()));
+				return redirected;
+			}
+		}
+
 		// Log misses under the path the visitor requested.
 		// Two shapes count as a miss: a 404 response (an unmatched route, or a
 		// page answering a content miss with Astro.rewrite("/404")), and a

package/src/astro/middleware.ts

@@ -84,7 +84,10 @@ import {
 } from "./middleware/scoped-db.js";
 import { wrapBodyForStreamMetrics } from "./middleware/stream-end-metrics.js";
 import { prefetchLayoutData } from "./prefetch.js";
-import { createPublicPluginApiRouteHandler } from "./public-plugin-api-routes.js";
+import {
+	createPublicPluginApiRouteHandler,
+	getPublicPluginRouteMeta,
+} from "./public-plugin-api-routes.js";
 import { resolveSessionUser } from "./session-user.js";
 import type { EmDashHandlers } from "./types.js";
 
@@ -895,6 +898,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 						// eslint-disable-next-line typescript/no-unsafe-type-assertion -- partial object; getPageRuntime() only checks for the page-contribution methods
 						locals.emdash = {
 							handlePublicPluginApiRoute,
+							getPublicPluginRouteMeta: (pluginId, path) =>
+								getPublicPluginRouteMeta(runtime, pluginId, path),
 							collectPageMetadata: runtime.collectPageMetadata.bind(runtime),
 							collectPageFragments: runtime.collectPageFragments.bind(runtime),
 							getPublicMediaUrl: createPublicMediaUrlResolver(runtime.storage),
@@ -971,9 +976,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					// Eagerly warm site-global layout data (menus, widget areas,
 					// taxonomy terms, settings) concurrently so the layout's
 					// per-component reads overlap into ~one wall-clock round trip and
-					// hit a warm cache instead of serializing. Three guards:
+					// hit a warm cache instead of serializing. Four guards:
 					//  - request-scoped (remote) backend only -- this branch implies it;
 					//    pointless on synchronous local SQLite.
+					//  - an adapter that can overlap queries -- without that, Kysely's
+					//    connection mutex (D1 sessions without `coalesce`) queues the
+					//    prefetch ahead of the page's own first query.
 					//  - HTML navigations only -- feeds/sitemaps/JSON don't render the
 					//    layout, so prefetching their chrome is pure waste.
 					//  - the work starts immediately, then after() keeps both it and the
@@ -987,7 +995,12 @@ export const onRequest = defineMiddleware(async (context, next) => {
 						.trim()
 						.startsWith("text/html");
 					return runWithContext(ctx, async () => {
-						if (acceptsHtml) after(() => prefetchLayoutData());
+						if (
+							acceptsHtml &&
+							anonScoped.db.getExecutor().adapter.supportsMultipleConnections !== false
+						) {
+							after(() => prefetchLayoutData());
+						}
 						// commit() persists per-request state (e.g. the D1 bookmark cookie)
 						// before the response is returned, even if render throws; close()
 						// waits for stream-end and request-owned deferred work. See finishScoped.
@@ -1092,6 +1105,8 @@ export const onRequest = defineMiddleware(async (context, next) => {
 					getPluginEditorExtension: runtime.getPluginEditorExtension.bind(runtime),
 					getPluginEditorDraftSchema: runtime.getPluginEditorDraftSchema.bind(runtime),
 					handlePublicPluginApiRoute: createPublicPluginApiRouteHandler(runtime),
+					getPublicPluginRouteMeta: (pluginId, path) =>
+						getPublicPluginRouteMeta(runtime, pluginId, path),
 					getPluginRouteMeta: runtime.getPluginRouteMeta.bind(runtime),
 					getPluginMcpTools: runtime.getPluginMcpTools.bind(runtime),
 					getEnabledPluginMcpTools: runtime.getEnabledPluginMcpTools.bind(runtime),

package/src/astro/prefetch.ts

@@ -7,17 +7,19 @@
  * execute as serial DB round trips. This fires them all CONCURRENTLY at the
  * very start of the request, before `next()`:
  *
- *   - On remote backends (D1, Durable Objects) the round trips overlap instead
- *     of serializing, collapsing ~N sequential RTTs into ~1 wall-clock RTT. On
- *     a coalescing backend they additionally batch into a single round trip.
+ *   - On remote backends whose adapter can overlap queries the round trips
+ *     overlap instead of serializing, collapsing ~N sequential RTTs into ~1
+ *     wall-clock RTT. On a coalescing backend they additionally batch into a
+ *     single round trip.
  *   - The results land in the per-request `requestCached` store under the exact
  *     keys the layout helpers use, so when the components render they hit a warm
  *     (in-flight or resolved) cache entry instead of issuing their own query.
  *
  * Nothing here changes what templates call -- it warms the real helpers, so the
  * cache keys and value shapes are guaranteed identical. The caller gates this to
- * the public-page path on a request-scoped (remote) backend; it is a no-op-ish
- * waste on synchronous local SQLite, so don't call it there.
+ * the public-page path on a request-scoped (remote) backend that can overlap
+ * queries; it is a no-op-ish waste on synchronous local SQLite and only delays
+ * the page on a handle that runs one query at a time, so don't call it there.
  *
  * Fire-and-forget: never awaited by middleware, never throws (a prefetch failure
  * must not affect the request -- the helpers will simply run on demand).

package/src/astro/public-plugin-api-routes.ts

@@ -18,6 +18,15 @@ interface PublicPluginApiRouteRuntime {
 	): Promise<HandlerResponse>;
 }
 
+export function getPublicPluginRouteMeta(
+	runtime: Pick<PublicPluginApiRouteRuntime, "getPluginRouteMeta">,
+	pluginId: string,
+	path: string,
+): RouteMeta | null {
+	const meta = runtime.getPluginRouteMeta(pluginId, path);
+	return meta?.public === true ? meta : null;
+}
+
 function pluginRouteNotFound(): HandlerResponse {
 	return {
 		success: false,
@@ -32,8 +41,7 @@ export function createPublicPluginApiRouteHandler(
 	runtime: PublicPluginApiRouteRuntime,
 ): PublicPluginApiRouteHandler {
 	return async (pluginId, method, path, request) => {
-		const meta = runtime.getPluginRouteMeta(pluginId, path);
-		if (meta?.public !== true) {
+		if (!getPublicPluginRouteMeta(runtime, pluginId, path)) {
 			return pluginRouteNotFound();
 		}
 

package/src/astro/routes/api/admin/plugins/registry/artifact.ts

@@ -423,7 +423,7 @@ async function resolveArtifact(
 			.map(recordScopedCacheEndpoint)
 			.find((value) => value !== null);
 		if (serviceEndpoint) {
-			const preset = kind === "icon" ? "avatar" : kind === "banner" ? "banner" : "feed_thumbnail";
+			const preset = kind === "icon" ? "avatar" : kind === "banner" ? "banner" : "feed_fullsize";
 			const cacheUrl = recordScopedImageCacheUrl(
 				serviceEndpoint,
 				preset,

package/src/astro/routes/api/content/[collection]/[id]/discard-draft.ts

@@ -11,6 +11,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { contentRevisionConditionBody } from "#api/schemas.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -68,7 +69,7 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/[id]/duplicate.ts

@@ -11,7 +11,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 
 export const prerender = false;
 
-export const POST: APIRoute = async ({ params, locals, cache }) => {
+export const POST: APIRoute = async ({ params, locals }) => {
 	const { emdash, user } = locals;
 	const collection = params.collection!;
 	const id = params.id!;
@@ -52,9 +52,5 @@ export const POST: APIRoute = async ({ params, locals, cache }) => {
 	const resolvedId = typeof existingItem?.id === "string" ? existingItem.id : id;
 	const result = await emdash.handleContentDuplicate(collection, resolvedId, user?.id);
 
-	if (!result.success) return unwrapResult(result);
-
-	if (cache?.enabled) await cache.invalidate({ tags: [collection] });
-
 	return unwrapResult(result, 201);
 };

package/src/astro/routes/api/content/[collection]/[id]/lock.ts

@@ -8,7 +8,7 @@
 
 import type { APIRoute } from "astro";
 
-import { requireOwnerPerm } from "#api/authorize.js";
+import { requireEntryEditPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import {
 	handleEntryLockAcquire,
@@ -60,7 +60,7 @@ async function resolveEntry(
 				(existingData.item as Record<string, unknown>)
 			: existingData;
 	const authorId = typeof existingItem?.authorId === "string" ? existingItem.authorId : "";
-	const denied = requireOwnerPerm(user, authorId, "content:edit_own", "content:edit_any");
+	const denied = requireEntryEditPerm(user, { authorId, status: existingItem?.status });
 	if (denied) return denied;
 
 	return {

package/src/astro/routes/api/content/[collection]/[id]/permanent.ts

@@ -8,6 +8,7 @@ import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, unwrapResult } from "#api/error.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -26,7 +27,7 @@ export const DELETE: APIRoute = async ({ params, locals, cache }) => {
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, id] });
+	await invalidateRouteCache(cache, [collection, id]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/[id]/publish.ts

@@ -18,6 +18,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { contentPublishBody } from "#api/schemas.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -98,7 +99,7 @@ export async function publishContent(
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 
 	return unwrapResult(result);
 }

package/src/astro/routes/api/content/[collection]/[id]/restore.ts

@@ -8,6 +8,7 @@ import type { APIRoute } from "astro";
 
 import { requireOwnerPerm } from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -50,7 +51,7 @@ export const POST: APIRoute = async ({ params, locals, cache }) => {
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/[id]/schedule.ts

@@ -12,6 +12,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { parseBody, isParseError } from "#api/parse.js";
 import { contentScheduleBody } from "#api/schemas.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -84,7 +85,7 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId ?? id] });
+	await invalidateRouteCache(cache, [collection, resolvedId ?? id]);
 
 	return unwrapResult(result);
 };
@@ -128,7 +129,7 @@ export const DELETE: APIRoute = async ({ params, locals, url, cache }) => {
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId ?? id] });
+	await invalidateRouteCache(cache, [collection, resolvedId ?? id]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/[id]/terms/[taxonomy].ts

@@ -7,11 +7,12 @@
 
 import type { APIRoute } from "astro";
 
-import { requirePerm, requireOwnerPerm } from "#api/authorize.js";
+import { requireAnyPerm, requireEntryEditPerm, requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess, handleError, requireDb } from "#api/error.js";
 import { parseBody, isParseError } from "#api/parse.js";
 import { contentTermsBody } from "#api/schemas.js";
 import { taxonomyTag } from "#cache/chrome-tags.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 import { ContentRepository } from "#db/repositories/content.js";
 import {
 	TaxonomyRepository,
@@ -111,7 +112,7 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 
 	const dbErr = requireDb(emdash?.db);
 	if (dbErr) return dbErr;
-	const denied = requirePerm(user, "content:edit_own");
+	const denied = requireAnyPerm(user, ["content:edit_own", "content:edit_own_drafts"]);
 	if (denied) return denied;
 
 	if (!emdash.handleContentGet) {
@@ -141,7 +142,7 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 				(existingData.item as Record<string, unknown>)
 			: existingData;
 	const authorId = typeof existingItem?.authorId === "string" ? existingItem.authorId : "";
-	const editDenied = requireOwnerPerm(user, authorId, "content:edit_own", "content:edit_any");
+	const editDenied = requireEntryEditPerm(user, { authorId, status: existingItem?.status });
 	if (editDenied) return editDenied;
 
 	// Resolve the canonical content ID from the handler result.
@@ -190,7 +191,7 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 					: [];
 			const tags = [collection, ...new Set([canonicalId, ...siblingIds]), taxonomyTag(taxonomy)];
 			for (const tagBatch of chunks(tags, MAX_CACHE_PURGE_TAGS)) {
-				await cache.invalidate({ tags: tagBatch });
+				await invalidateRouteCache(cache, tagBatch);
 			}
 		}
 

package/src/astro/routes/api/content/[collection]/[id]/unpublish.ts

@@ -11,6 +11,7 @@ import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { isParseError, parseOptionalBody } from "#api/parse.js";
 import { contentRevisionConditionBody } from "#api/schemas.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -70,7 +71,7 @@ export const POST: APIRoute = async ({ params, request, locals, url, cache }) =>
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/[id].ts

@@ -9,11 +9,17 @@
 import { hasPermission } from "@emdash-cms/auth";
 import type { APIRoute } from "astro";
 
-import { requirePerm, requireOwnerPerm } from "#api/authorize.js";
+import {
+	entryEditAccess,
+	requireEntryEditPerm,
+	requireOwnerPerm,
+	requirePerm,
+} from "#api/authorize.js";
 import { apiError, mapErrorStatus, unwrapResult } from "#api/error.js";
 import { claimEntryLockForWrite } from "#api/handlers/entry-lock.js";
 import { parseBody, isParseError } from "#api/parse.js";
 import { contentUpdateBody } from "#api/schemas.js";
+import { invalidateRouteCache } from "#cache/route-cache.js";
 
 export const prerender = false;
 
@@ -100,8 +106,14 @@ export const PUT: APIRoute = async ({ params, request, locals, cache }) => {
 				(existingData.item as Record<string, unknown>)
 			: existingData;
 	const authorId = typeof existingItem?.authorId === "string" ? existingItem.authorId : "";
-	const editDenied = requireOwnerPerm(user, authorId, "content:edit_own", "content:edit_any");
+	const entry = { authorId, status: existingItem?.status };
+	const editDenied = requireEntryEditPerm(user, entry);
 	if (editDenied) return editDenied;
+	// A draft-only grant covers the entry only while it is a draft. Conditioning
+	// the save on the checked revision makes it fail if the entry is published
+	// between this check and the write.
+	const checkedRev = typeof existingData?._rev === "string" ? existingData._rev : undefined;
+	const rev = entryEditAccess(user, entry) === "draft" ? (body._rev ?? checkedRev) : body._rev;
 
 	// Only EDITOR+ can write publishedAt directly — incl. clearing to null.
 	if (body.publishedAt !== undefined && !hasPermission(user, "content:publish_any")) {
@@ -137,14 +149,14 @@ export const PUT: APIRoute = async ({ params, request, locals, cache }) => {
 	const result = await emdash.handleContentUpdate(collection, resolvedId, {
 		...writeBody,
 		locale,
-		_rev: body._rev,
+		_rev: rev,
 		actor,
 	});
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled && result.liveContentChanged !== false) {
-		await cache.invalidate({ tags: [collection, resolvedId] });
+	if (result.liveContentChanged !== false) {
+		await invalidateRouteCache(cache, [collection, resolvedId]);
 	}
 
 	return unwrapResult(result);
@@ -203,7 +215,7 @@ export const DELETE: APIRoute = async ({ params, locals, url, cache }) => {
 
 	if (!result.success) return unwrapResult(result);
 
-	if (cache?.enabled) await cache.invalidate({ tags: [collection, resolvedId] });
+	await invalidateRouteCache(cache, [collection, resolvedId]);
 
 	return unwrapResult(result);
 };

package/src/astro/routes/api/content/[collection]/index.ts

@@ -38,7 +38,7 @@ export const GET: APIRoute = async ({ params, url, locals }) => {
 	return unwrapResult(result);
 };
 
-export const POST: APIRoute = async ({ params, request, locals, cache }) => {
+export const POST: APIRoute = async ({ params, request, locals }) => {
 	const { emdash, user } = locals;
 	if (!emdash?.handleContentCreate || !emdash?.handleContentGet) {
 		return apiError("NOT_CONFIGURED", "EmDash is not initialized", 500);
@@ -90,9 +90,5 @@ export const POST: APIRoute = async ({ params, request, locals, cache }) => {
 		actor,
 	});
 
-	if (!result.success) return unwrapResult(result);
-
-	if (cache?.enabled) await cache.invalidate({ tags: [collection] });
-
 	return unwrapResult(result, 201);
 };

package/src/astro/routes/api/dashboard.ts

@@ -4,6 +4,7 @@
  * GET /_emdash/api/dashboard - Collection counts, media/user counts, recent items
  */
 
+import { hasPermission } from "@emdash-cms/auth";
 import type { APIRoute } from "astro";
 
 import { requirePerm } from "#api/authorize.js";
@@ -23,7 +24,9 @@ export const GET: APIRoute = async ({ locals }) => {
 	}
 
 	try {
-		const result = await handleDashboardStats(emdash.db);
+		const result = await handleDashboardStats(emdash.db, {
+			includeDrafts: hasPermission(user, "content:read_drafts"),
+		});
 
 		return unwrapResult(result);
 	} catch (error) {

package/src/astro/routes/api/dev/scheduled-tasks.ts

@@ -0,0 +1,20 @@
+import type { APIRoute } from "astro";
+
+import { apiError } from "#api/error.js";
+
+import { runScheduledTasks } from "../../../middleware.js";
+
+export const prerender = false;
+
+/**
+ * Cloudflare development bridge for EmDash-owned scheduled maintenance.
+ * The integration injects this route only during Cloudflare `astro dev`.
+ */
+export const POST: APIRoute = async () => {
+	if (!import.meta.env.DEV) {
+		return apiError("FORBIDDEN", "Dev maintenance is only available in development mode", 403);
+	}
+
+	await runScheduledTasks();
+	return new Response(null, { status: 204 });
+};

package/src/astro/routes/api/import/wordpress/analyze.ts

@@ -13,6 +13,7 @@ import mime from "mime/lite";
 
 import { requirePerm } from "#api/authorize.js";
 import { apiError, apiSuccess, handleError } from "#api/error.js";
+import { isInternalPostType } from "#import/utils.js";
 import { RESERVED_COLLECTION_SLUGS } from "#schema/types.js";
 import type { EmDashHandlers } from "#types";
 
@@ -423,22 +424,6 @@ function isTypeCompatible(requiredType: string, existingType: string): boolean {
 	return compatible?.includes(existingType) ?? false;
 }
 
-function isInternalPostType(type: string): boolean {
-	return [
-		"revision",
-		"nav_menu_item",
-		"custom_css",
-		"customize_changeset",
-		"oembed_cache",
-		"wp_global_styles",
-		"wp_navigation",
-		"wp_template",
-		"wp_template_part",
-		"attachment", // Handled separately as media
-		"wp_block", // Handled separately as sections (reusable blocks)
-	].includes(type);
-}
-
 function isInternalMetaKey(key: string): boolean {
 	if (key.startsWith("_edit_")) return true;
 	if (key.startsWith("_wp_")) return true;